Executive brief
GNU Bison, a widely used tool for generating programming language parsers, is vulnerable to a security flaw that allows for the execution of unauthorized programs. If a user processes a specially crafted grammar file provided by an attacker, the tool can be tricked into running malicious code with the same permissions as the user. This could lead to a full system compromise or unauthorized access to sensitive data on the developer's machine.
Technical details
GNU Bison is vulnerable to OS command injection (CWE-78) within its HTML report generation component. The vulnerability exists because the `%define tool.xsltproc` directive in a grammar file allows a user to override the executable used for XML-to-HTML transformation. This user-controlled string is passed directly to the `execvp()` function without adequate validation or restriction. An attacker can exploit this by providing a malicious grammar file to a user who then runs `bison --html` on it, resulting in arbitrary code execution with the privileges of the Bison process. The issue was addressed by removing support for the undocumented `tool.xsltproc` variable and hardcoding the use of `xsltproc` from the system PATH.
Affected products
- GNU Bison 3.8.2
Timeline
- 2026-04-23: patched: Fixed in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b
- 2026-07-29: disclosed: Advisory published by CERT Polska and NVD